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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview 
with Kent Sieffert (Reg. # 41 ,312) on 10/20/2008. 

Examiner's NOTE: In regards to claims 28-39, it states "network elements 
comprising: an interface... a control unit... wherein the control unit computes...". 
Examiner interpreted network elements being hardware rather than software per se in 
view of the specification of the current application, as it is stated in paragraph 27, that 
"network device may be any in which traffic analysis and reporting functionality is 
integrated such as a router, hub, gateway, switch and the like". This means that network 
element is hardware since router, hub, gateway and switches are hardware. 

In regards with claims 39-40, it states "network device comprising: an interface, a 
control unit, an accounting service card....". Examiner interpreted network device being 
hardware rather than software per se in view of the specification of the current 
application, as it is stated in paragraph 27, that "network device may be any in which 
traffic analysis and reporting functionality is integrated such as a router, hub, gateway, 
switch and the like". This means that network device is hardware since router, hub, 
gateway and switches are hardware 

The application has been amended as follows: 



Application/Control Number: 10/670,944 
Art Unit: 2451 



Page 3 



In the Claims 

Please AMEND claims 1,12,13,15,21,28,39,40 have been replaced with the 
following amended claims: 

Claim 1 (Currently Amended) A method comprising: 

calculating traffic statistics associated with packet flows through a network; 
storing the traffic statistics within a flow table; 

maintaining a heap that provides a heap-ordered representation of at least a 
portion of the traffic statistics of the packet flows within the flow table, wherein the heap 
is a tree having a root node and a plurality of other nodes arranged as parent nodes and 
child nodes, each of the nodes storing traffic statistics for a different one of the packet 
flows, and wherein the tree is heap-ordered in that a value for the traffic statistics stored 
in any child node of the tree is less than or equal to a value for the traffic statistics 
stored for its w i th i n that ch il d nod e 's parent node within the tree; 

receiving a query from a client: 

processing the heap in response to the query to select one or more of the nodes 
of the tree while continuing to update the traffic flow statistics in the flow table in 
response to network traffic; and 

outputting the traffic statistics associated with the selected nodes of the tree to 
the client- 
process i ng tho hoap to so l oct ono or more of the packet f l ows; and 
outputt i ng tho traff i c stat i st i cs associated w i th tho so l octod packet f l ows. 



Claim 2 (Cancelled) 



Application/Control Number: 10/670,944 Page 4 

Art Unit: 2451 

Claim 12 (Currently Amended) The method of claim 1 , furth e r compr i s i ng: 

wherein receiving a query comprises receiving f rom a n e twork c lie nt, wh e r ei n th e 

a_query requests M ordered packet flows^ 

wherein processing the heap comprises cloning the heap to produce a heap 

clone in response to the query and performing M-1 heapify operations to extract the M 

ordered packet flow identifiers from the heap^ and 

wherein outputting the traffic statistics comprises outputting the traffic statistics 

associated with the M packet flow identifiers. 

Claim 13 (Currently Amended) A method comprising: 

calculating traffic statistics associated with packet flows through a network: 
storing the traffic statistics within a flow table: 

maintaining a heap that provides a heap-ordered representation of the packet 
flows within a network based on at least one criteria associated with the packet flows, 
the heap-ordered representation of packet flows comprising [[is]] a tree having a root 
node and a plurality of other nodes arranged as parent nodes and child nodes, each of 
the nodes storing traffic statistics for a different one of the packet flows, and wherein a 
value for the traffic statistics stored in any child node is less than or equal to a value for 
the traffic statistics stored for its parent node within the tree; and 

receiving a query from a client: 

processing the heap in response to the query to select one or more of the nodes 

of the tree while continuing to update the traffic flow statistics in the flow table in 

response to network traffic: and 

outputting the traffic statistics associated with the selected nodes of the tree to 

the client- 
proc e ss i ng th e h e ap to output traff i c statistics assoc i at e d w i th an ord e r e d subs e t 

of th e pack e t f l ows. 
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Claim 15 (Currently Amended) The method of claim 13, wherein processing the heap 
and outputting the traffic statistics comprises: 
r e c ei v i ng a qu e ry from a n e twork c lie nt; 

cloning the heap to produce a heap clone in response to receiving the query from 
the client : 

extracting one or more heap entries from the heap clone to extract identifiers for 
the ordered subset of the packet flows; and 

outputting the traffic statistics associated with the extracted identifiers. 
Claim 17-20 (Cancelled) 

Claim 21 (Currently Amended) A computer-readable medium comprising instructions 
for causing a programmable processor to: 

calculate traffic statistics associated with packet flows through a network; 

store the traffic statistics within a flow table; 

maintain a heap that provides a heap-ordered representation of at least a portion 
of the traffic statistics of the packet flows within the flow table, wherein the heap is a tree 
having a root node and a plurality of other nodes arranged as parent nodes and child 
nodes, each of the nodes storing traffic statistics for a different one of the packet flows, 
and wherein the tree is heap-ordered in that a value for the traffic statistics stored in any 
child node of the tree is less than or equal to a value for the traffic statistics stored for its 
parent node within the tree ; 

receive a query from a client; 

process the heap in response to the query to select one or more of the nodes of 
the tree while updating the traffic statistics in a flow table in response to network traffic; 
and 

output the traffic statistics associated with the selected nodes of the tree to the 

client- 
proc e ss th e h e ap to s ele ct on e or mor e of th e pack e t f l ows; and 
output th e traff i c stat i st i cs assoc i at e d w i th th e s ele ct e d pack e t f l ows. 



Claim 22 (Cancelled) 
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Claim 28 (Currently Amended) Network elements comprising: 

[[an]] a network interface to receive packets flows from a network; an4 
a user interface to receive a query from a client: and 
a control unit coupled to the network interface, 

wherein the control unit computes flow statistics for the packets 7 and maintains 
identifiers for the packet flows in a heap-ordered representation based on at least one of 
the statistics, 

wherein the heap-ordered representation is a tree having a root node and a 
plurality of other nodes arranged as parent nodes and child nodes, each of the nodes 
storing traffic statistics for a different one of the packet flows, and wherein the tree is 
heap-ordered in that a value for the traffic statistics stored in any child node of the tree 
is less than or equal to a value for the traffic statistics stored for its w i th i n that ch il d 
nodo'o parent node within the tree A 

wherein the control unit processes the heap to select one or more of the 
identifiers in response to receiving the query from the client, and 

wherein the user interface outputs a portion of the traffic statistics associated with 
the selected identifiers . 

Claim 30 (Cancelled) 

Claim 39 (Currently Amended) A network device comprising: 
an interface to receive packets flows from a network; 
a control unit coupled to the interface; <md 

an accounting service card comprising a flow table to store flow statistics , 
wherein the control unit forwards the packets to the accounting service card to calculate 
the traffic statistics, wherein the accounting service card computes the flow statistics for 
the packets, and maintains ma i nta i n i ng a heap that provides a heap-ordered 
representation of the packet flows within the flow table, wherein the heap is a tree 
having a root node and a plurality of other nodes arranged as parent nodes and child 
nodes, each of the nodes storing traffic statistics for a different one of the packet flows. 
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and wherein the tree is heap-ordered in that a value for the traffic statistics stored in any 
child node of the tree is less than or equal to a value for the traffic statistics stored for its 
parent node within the tree: and 

a user interface to receive a query from a client, 

wherein the accounting service card is configured to process the heap in 
response to the query to select one or more nodes of the tree while continuing to update 
the traffic flow statistics in the flow table in response to network traffic, and 

wherein the user interface is configured to output the traffic statistics associated 
with the selected nodes of the tree to the client . 

Claim 40 (Currently Amended) The network device of claim 39, wherein the 
accounting service card further comprises^ 

a f l ow tab l e to store the f l ow stat i stics; and 

a heap table to store the heap. 

Allowable Subject Matter 

Claims 1,3-16,21,23-27,28-29,31-40 respectively are allowed. Claims 2,17- 
20,22,30 are cancelled. Claims 1 ,3-16,21 ,23-27,28-29,31-40 respectively are 
renumbered as claims 1,2-15,16,17-21,22-23,24-33 respectively. 

Reasons for Allowance 

The following is an examiner's statement of reasons for allowance: "maintaining 
a heap that provides a heap-ordered representation of at least a portion of the traffic 
statistics of the packet flows within the flow table, wherein the heap is a tree having a 
root node and a plurality of other nodes arranged as parent nodes and child nodes, 
each of the nodes storing traffic statistics for a different one of the packet flows, and 
wherein the tree is heap-ordered in that a value for the traffic statistics stored in any 
child node of the tree is less than or equal to a value for the traffic statistics stored for its 
parent node within the tree". 
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Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Dhairya A. Patel whose telephone number is 571-272- 
5809. The examiner can normally be reached on Monday-Friday 8:00AM-5: 30PM, first 
Fridays OFF. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Follansbee can be reached on 571-272-3964. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



DAP 
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